ZIT Studio is committed to maintaining a secure, reliable, and transparent open-source ecosystem. We welcome responsible security research and appreciate reports from researchers, users, and community members.
If you believe you have found a security vulnerability affecting a ZIT Studio project or service, please report it privately using GitHub Private Vulnerability Reporting or GitHub Security Advisories when available. If neither option is available, contact the maintainers through the official contact information listed in the relevant repository or on the ZIT Studio website. Please do not disclose unpatched vulnerability details publicly.
We will make reasonable efforts to acknowledge reports within three business days, complete an initial assessment within seven business days, and provide progress updates approximately every seven business days. These are targets, not guarantees. We coordinate disclosure with reporters and affected maintainers, and generally use 90 days after the first valid report as a discussion reference—not a mandatory waiting period or absolute deadline.
For the complete policy, including scope, handling process, researcher protections, and responsible testing guidelines, see the English security policy or the 简体中文安全政策.